@opengeni/db 3.2.2 → 3.3.0

package/drizzle/0795_site_lifecycle_cancellation.sql

@@ -0,0 +1,121 @@
+-- deployment-mode: rolling
+-- Cancel-only host lifecycle commands reuse the native session control writer.
+-- A private transaction-local witness admits its exact Site root/subtree; it
+-- is never a viewer identity, bearer permission, or tenancy-inventory exception.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE INDEX site_runtime_conversations_cancel_page_idx
+  ON site_runtime_conversations(account_id, workspace_id, site_id, session_id);
+
+CREATE TABLE opengeni_private.site_session_cancellation_capabilities (
+  capability_id uuid NOT NULL UNIQUE,
+  target_schema oid NOT NULL,
+  backend_pid integer NOT NULL,
+  transaction_id xid8 NOT NULL,
+  account_id uuid NOT NULL,
+  workspace_id uuid NOT NULL,
+  site_id uuid NOT NULL,
+  root_session_id uuid NOT NULL,
+  subject_id text,
+  initiating_human_subject_id text,
+  PRIMARY KEY (backend_pid, transaction_id)
+);
+REVOKE ALL ON TABLE opengeni_private.site_session_cancellation_capabilities FROM PUBLIC;
+
+DO $functions$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE FUNCTION %1$I.site_session_cancellation_capability_active(
+      a uuid,w uuid,site uuid,root uuid
+    ) RETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path=pg_catalog AS $fn$
+      SELECT EXISTS (
+        SELECT 1 FROM opengeni_private.site_session_cancellation_capabilities c
+        WHERE c.target_schema=%2$s::oid AND c.backend_pid=pg_backend_pid()
+          AND c.transaction_id=pg_current_xact_id_if_assigned()
+          AND c.account_id=a AND c.workspace_id=w AND c.site_id=site AND c.root_session_id=root
+          AND a=nullif(current_setting('opengeni.account_id',true),'')::uuid
+          AND w=nullif(current_setting('opengeni.workspace_id',true),'')::uuid
+          AND c.subject_id IS NOT DISTINCT FROM nullif(current_setting('opengeni.subject_id',true),'')
+          AND c.initiating_human_subject_id IS NOT DISTINCT FROM nullif(current_setting('opengeni.initiating_human_subject_id',true),'')
+      )
+    $fn$;
+
+    CREATE FUNCTION opengeni_private.begin_site_session_cancellation(a uuid,w uuid,site uuid,root uuid)
+    RETURNS uuid LANGUAGE plpgsql VOLATILE SECURITY DEFINER
+    SET search_path=pg_catalog,%1$I,opengeni_private,pg_temp AS $fn$
+    DECLARE token uuid:=gen_random_uuid(); actor text:=nullif(current_setting('opengeni.subject_id',true),'');
+      human text:=nullif(current_setting('opengeni.initiating_human_subject_id',true),'');
+    BEGIN
+      IF a IS NULL OR w IS NULL OR site IS NULL OR root IS NULL
+        OR a IS DISTINCT FROM nullif(current_setting('opengeni.account_id',true),'')::uuid
+        OR w IS DISTINCT FROM nullif(current_setting('opengeni.workspace_id',true),'')::uuid
+        OR actor LIKE 'site:%%' THEN
+        RAISE EXCEPTION 'Site lifecycle cancellation requires exact host scope' USING ERRCODE='42501';
+      END IF;
+      -- Trusted application lifecycle only. The mapping proves association
+      -- without granting a service principal transcript access.
+      IF NOT EXISTS(SELECT 1 FROM %1$I.site_runtime_conversations c
+        WHERE c.account_id=a AND c.workspace_id=w AND c.site_id=site AND c.session_id=root) THEN
+        RAISE EXCEPTION 'Site cancellation target is unavailable' USING ERRCODE='42501';
+      END IF;
+      INSERT INTO opengeni_private.site_session_cancellation_capabilities
+        VALUES(token,%2$s::oid,pg_backend_pid(),pg_current_xact_id(),a,w,site,root,actor,human);
+      -- Root identity avoids the generic hidden-ancestor reader entirely.
+      IF NOT EXISTS(SELECT 1 FROM %1$I.sessions s WHERE s.account_id=a AND s.workspace_id=w
+        AND s.id=root AND s.site_id=site AND s.site_access_root_id=root
+        AND s.root_session_id=root AND s.parent_session_id IS NULL) THEN
+        DELETE FROM opengeni_private.site_session_cancellation_capabilities WHERE capability_id=token;
+        RETURN NULL;
+      END IF;
+      RETURN token;
+    END
+    $fn$;
+
+    CREATE FUNCTION opengeni_private.end_site_session_cancellation(token uuid)
+    RETURNS void LANGUAGE sql VOLATILE SECURITY DEFINER SET search_path=pg_catalog AS $fn$
+      DELETE FROM opengeni_private.site_session_cancellation_capabilities c
+        WHERE c.capability_id=token AND c.target_schema=%2$s::oid
+          AND c.backend_pid=pg_backend_pid() AND c.transaction_id=pg_current_xact_id_if_assigned()
+    $fn$;
+  $ddl$,data_schema,current_schema()::regnamespace::oid);
+END
+$functions$;
+
+-- Preserve installed native/private and Site predicates. Both restrictive
+-- gates admit only this exact command witness, never general inventory.
+DO $policies$
+DECLARE p record; n integer:=0;
+  allowance text:=format('%I.site_session_cancellation_capability_active(account_id,workspace_id,site_id,site_access_root_id)',current_schema());
+BEGIN
+  FOR p IN SELECT polname,pg_get_expr(polqual,polrelid) qual,
+      pg_get_expr(polwithcheck,polrelid) check_expr,polpermissive,polcmd
+    FROM pg_policy WHERE polrelid='sessions'::regclass
+      AND polname IN ('session_visibility_isolation','site_viewer_isolation') LOOP
+    IF p.polpermissive OR p.polcmd<>'*' OR p.qual IS NULL OR p.check_expr IS NULL THEN
+      RAISE EXCEPTION 'Unexpected session cancellation policy contract' USING ERRCODE='55000';
+    END IF;
+    EXECUTE format('ALTER POLICY %I ON %I.sessions USING ((%s) OR %s) WITH CHECK ((%s) OR %s)',
+      p.polname,current_schema(),p.qual,allowance,p.check_expr,allowance);
+    n:=n+1;
+  END LOOP;
+  IF n<>2 THEN RAISE EXCEPTION 'Missing session cancellation policy contract' USING ERRCODE='55000'; END IF;
+END
+$policies$;
+
+REVOKE ALL ON FUNCTION opengeni_private.begin_site_session_cancellation(uuid,uuid,uuid,uuid) FROM PUBLIC;
+REVOKE ALL ON FUNCTION opengeni_private.end_site_session_cancellation(uuid) FROM PUBLIC;
+-- The policy predicate is value-free; callers cannot mint its witness.
+GRANT EXECUTE ON FUNCTION site_session_cancellation_capability_active(uuid,uuid,uuid,uuid) TO PUBLIC;
+DO $acl$
+DECLARE role_name text;
+BEGIN
+  FOR role_name IN SELECT DISTINCT r.rolname FROM pg_roles r
+    JOIN jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) configured(value)
+      ON r.rolname=configured.value LOOP
+    EXECUTE format('REVOKE ALL ON TABLE opengeni_private.site_session_cancellation_capabilities FROM %I',role_name);
+    EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.begin_site_session_cancellation(uuid,uuid,uuid,uuid),opengeni_private.end_site_session_cancellation(uuid) TO %I',role_name);
+  END LOOP;
+END
+$acl$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "3.2.2",
+  "version": "3.3.0",
   "description": "Opengeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -117,14 +117,14 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "3.2.2",
-    "@opengeni/codex": "3.2.2",
-    "@opengeni/config": "3.2.2",
-    "@opengeni/contracts": "3.2.2",
-    "@opengeni/network": "3.2.2",
-    "@opengeni/observability": "3.2.2",
-    "@opengeni/subscriptions": "3.2.2",
-    "@opengeni/xai-subscription": "3.2.2",
+    "@opengeni/codemode": "3.3.0",
+    "@opengeni/codex": "3.3.0",
+    "@opengeni/config": "3.3.0",
+    "@opengeni/contracts": "3.3.0",
+    "@opengeni/network": "3.3.0",
+    "@opengeni/observability": "3.3.0",
+    "@opengeni/subscriptions": "3.3.0",
+    "@opengeni/xai-subscription": "3.3.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/database.ts

@@ -63,8 +63,20 @@ export type SessionRlsActorContext = {
   /** Host-verified personal file ownership, never a request-supplied subject. */
   privateFileOwnerSubjectId?: string | null;
   initiatingHumanSubjectId?: string | null;
+  /** Root reconstructed from a verified live agent attempt, never page input. */
+  agentRootSessionId?: string | null;
 };
 
+/** Request-local proof from the signed published-Site gateway and live viewer cookie. */
+export type SiteViewerRlsContext = Readonly<{ siteId: string; principal: string }>;
+const siteViewerRlsContext = new AsyncLocalStorage<SiteViewerRlsContext>();
+export function currentSiteViewerRlsContext(): SiteViewerRlsContext | undefined {
+  return siteViewerRlsContext.getStore();
+}
+export function withSiteViewerRlsContext<T>(context: SiteViewerRlsContext, run: () => T): T {
+  return siteViewerRlsContext.run(Object.freeze({ ...context }), run);
+}
+
 const sessionRlsActorContext = new AsyncLocalStorage<SessionRlsActorContext>();
 export function currentSessionAttachmentReadAccess(): SessionAttachmentReadAccess | undefined {
   return sessionRlsActorContext.getStore()?.sessionAttachmentReadAccess;
@@ -94,6 +106,8 @@ export function currentSessionRlsActorIdentityKey(): string | null {
     actor.initiatingHumanSubjectId ?? null,
     actor.privateFileOwnerSubjectId ?? null,
     actor.sessionAttachmentReadAccess ?? null,
+    actor.agentRootSessionId ?? null,
+    siteViewerRlsContext.getStore() ?? null,
   ]);
 }
 
@@ -144,6 +158,9 @@ type RlsContextSettings = {
   initiatingHumanSubjectId: string;
   personalResourceHumanSubjectId: string;
   personalResourceActorSubjectId: string;
+  agentRootSessionId: string;
+  siteId: string;
+  siteViewerPrincipal: string;
 };
 
 /**
@@ -475,8 +492,14 @@ export async function setRlsContext(db: Database, context: RlsContext): Promise<
     set_config('opengeni.pending_tool_event_output_v1', '1', true),
     set_config('opengeni.session_variable_set_attachments_v1', '1', true),
     set_config('opengeni.shared_personal_choice_v1', '1', true),
+    set_config('opengeni.site_session_audience_v1', '1', true),
     set_config('jit', 'off', true)`);
   const sessionActor = sessionRlsActorContext.getStore();
+  const siteViewer = siteViewerRlsContext.getStore();
+  await db.execute(sql`select
+    set_config('opengeni.agent_root_session_id', ${sessionActor?.agentRootSessionId ?? ""}, true),
+    set_config('opengeni.site_id', ${siteViewer?.siteId ?? ""}, true),
+    set_config('opengeni.site_viewer_principal', ${siteViewer?.principal ?? ""}, true)`);
   if (sessionActor) {
     await setSubjectRlsContext(db, sessionActor.subjectId);
     await db.execute(
@@ -498,6 +521,9 @@ async function readRlsContextSettings(db: Database): Promise<RlsContextSettings>
     initiating_human_subject_id: string | null;
     personal_resource_human_subject_id: string | null;
     personal_resource_actor_subject_id: string | null;
+    agent_root_session_id: string | null;
+    site_id: string | null;
+    site_viewer_principal: string | null;
   }>(
     db,
     sql`select
@@ -507,7 +533,10 @@ async function readRlsContextSettings(db: Database): Promise<RlsContextSettings>
       current_setting('opengeni.private_file_owner', true) as private_file_owner,
       current_setting('opengeni.initiating_human_subject_id', true) as initiating_human_subject_id,
       current_setting('opengeni.personal_resource_human_subject_id', true) as personal_resource_human_subject_id,
-      current_setting('opengeni.personal_resource_actor_subject_id', true) as personal_resource_actor_subject_id`,
+      current_setting('opengeni.personal_resource_actor_subject_id', true) as personal_resource_actor_subject_id,
+      current_setting('opengeni.agent_root_session_id', true) as agent_root_session_id,
+      current_setting('opengeni.site_id', true) as site_id,
+      current_setting('opengeni.site_viewer_principal', true) as site_viewer_principal`,
   );
   return {
     accountId: settings?.account_id ?? "",
@@ -517,6 +546,9 @@ async function readRlsContextSettings(db: Database): Promise<RlsContextSettings>
     initiatingHumanSubjectId: settings?.initiating_human_subject_id ?? "",
     personalResourceHumanSubjectId: settings?.personal_resource_human_subject_id ?? "",
     personalResourceActorSubjectId: settings?.personal_resource_actor_subject_id ?? "",
+    agentRootSessionId: settings?.agent_root_session_id ?? "",
+    siteId: settings?.site_id ?? "",
+    siteViewerPrincipal: settings?.site_viewer_principal ?? "",
   };
 }
 
@@ -547,6 +579,9 @@ async function restoreRlsContextSettings(
     initiating_human_subject_id: string;
     personal_resource_human_subject_id: string;
     personal_resource_actor_subject_id: string;
+    agent_root_session_id: string;
+    site_id: string;
+    site_viewer_principal: string;
   }>(
     db,
     sql`select
@@ -556,7 +591,10 @@ async function restoreRlsContextSettings(
       set_config('opengeni.private_file_owner', ${settings.privateFileOwnerSubjectId}, true) as private_file_owner,
       set_config('opengeni.initiating_human_subject_id', ${settings.initiatingHumanSubjectId}, true) as initiating_human_subject_id,
       set_config('opengeni.personal_resource_human_subject_id', ${settings.personalResourceHumanSubjectId}, true) as personal_resource_human_subject_id,
-      set_config('opengeni.personal_resource_actor_subject_id', ${settings.personalResourceActorSubjectId}, true) as personal_resource_actor_subject_id`,
+      set_config('opengeni.personal_resource_actor_subject_id', ${settings.personalResourceActorSubjectId}, true) as personal_resource_actor_subject_id,
+      set_config('opengeni.agent_root_session_id', ${settings.agentRootSessionId}, true) as agent_root_session_id,
+      set_config('opengeni.site_id', ${settings.siteId}, true) as site_id,
+      set_config('opengeni.site_viewer_principal', ${settings.siteViewerPrincipal}, true) as site_viewer_principal`,
   );
   if (
     restored?.account_id !== settings.accountId ||
@@ -565,7 +603,10 @@ async function restoreRlsContextSettings(
     restored.private_file_owner !== settings.privateFileOwnerSubjectId ||
     restored.initiating_human_subject_id !== settings.initiatingHumanSubjectId ||
     restored.personal_resource_human_subject_id !== settings.personalResourceHumanSubjectId ||
-    restored.personal_resource_actor_subject_id !== settings.personalResourceActorSubjectId
+    restored.personal_resource_actor_subject_id !== settings.personalResourceActorSubjectId ||
+    restored.agent_root_session_id !== settings.agentRootSessionId ||
+    restored.site_id !== settings.siteId ||
+    restored.site_viewer_principal !== settings.siteViewerPrincipal
   ) {
     throw new Error("RLS context could not be restored after a nested scope");
   }

package/src/index.ts

@@ -518,6 +518,7 @@ export * from "./site-data";
 export * from "./site-publishing";
 export { withSiteRuntimeAdmission } from "./site-runtime-admission";
 export * from "./site-platform";
+export * from "./insights-site-usage";
 export * from "./scheduled-slack-bot-messages";
 export * from "./organization-signup-use-cases";
 export * from "./site-sql";
@@ -1011,6 +1012,7 @@ import {
   workspaceControlLockBudget,
   workspaceControlRequestLockTimeoutMs,
   lockWorkspaceInferenceControl,
+  mutateSessionControlInTransaction,
   registerInternalUpdateWakeInTransaction,
   registerSessionWorkflowWakeInTransaction,
   SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS,
@@ -1245,6 +1247,7 @@ export * from "./model-catalog";
 
 import {
   dbBindingFor,
+  isTransactionHandle,
   rawRows,
   retryRlsPersistence,
   retryWorkspacePersistence,
@@ -1301,6 +1304,9 @@ export {
 } from "./database";
 export {
   currentSessionRlsActorIdentityKey,
+  currentSessionRlsActorContext,
+  currentSiteViewerRlsContext,
+  withSiteViewerRlsContext,
   currentSessionRlsActorInitiatingHumanSubjectId,
   withSessionRlsActorContext,
 } from "./database";
@@ -29679,7 +29685,7 @@ async function createSessionInTransaction(
   );
   const createIdempotencyKey = input.createIdempotencyKey ?? null;
   const createRequestedVisibility = input.visibility ?? "workspace_shared";
-  if (createRequestedVisibility === "user_private") {
+  if (createRequestedVisibility === "user_private" || sessionMetadata._opengeniSiteOrigin) {
     // Private creation later proves the owner's live organization membership
     // and, for a fresh top-level organization session, reads the mutable
     // owner/admin enablement setting. Serialize both checks with organization
@@ -30883,6 +30889,10 @@ export type SessionAuthorityProjection = SessionAccessProjection & {
   authorityEpoch: number;
   visibility: "user_private" | "workspace_shared";
   ownerSubjectId: string | null;
+  siteId: string | null;
+  siteAccessRootId: string | null;
+  siteViewerPrincipal: string | null;
+  siteOwnerSubjectId: string | null;
 };
 
 type SessionAccessRow = Pick<
@@ -30924,6 +30934,10 @@ export async function getSessionAuthorityProjection(
         visibility: schema.sessions.visibility,
         authorityEpoch: schema.sessions.authorityEpoch,
         ownerSubjectId: schema.sessions.ownerSubjectId,
+        siteId: schema.sessions.siteId,
+        siteAccessRootId: schema.sessions.siteAccessRootId,
+        siteViewerPrincipal: schema.sessions.siteViewerPrincipal,
+        siteOwnerSubjectId: schema.sessions.siteOwnerSubjectId,
         agentAccess: schema.sessions.agentAccess,
         scopeSubjectId: schema.sessions.scopeSubjectId,
         memoryScope: schema.sessions.memoryScope,
@@ -30938,6 +30952,10 @@ export async function getSessionAuthorityProjection(
       rootSessionId: row.rootSessionId,
       visibility: row.visibility as SessionAuthorityProjection["visibility"],
       ownerSubjectId: row.ownerSubjectId ?? null,
+      siteId: row.siteId ?? null,
+      siteAccessRootId: row.siteAccessRootId ?? null,
+      siteViewerPrincipal: row.siteViewerPrincipal ?? null,
+      siteOwnerSubjectId: row.siteOwnerSubjectId ?? null,
       agentAccess: sessionAgentAccessFromRow(row),
       scopeSubjectId: sessionEndUserFromRow(row),
       memoryScope: sessionMemoryScopeFromRow(row),
@@ -32548,7 +32566,17 @@ function sessionFilters(
   }
   if (options.originSiteId) {
     filters.push(
-      sql`${schema.sessions.metadata}->'_opengeniSiteOrigin'->>'siteId' = ${options.originSiteId}`,
+      eq(schema.sessions.siteId, options.originSiteId),
+      sql`${schema.sessions.siteAccessRootId} is not null`,
+    );
+  } else {
+    // App-internal execution is not ordinary workspace conversation discovery.
+    // This is presentation scope only: native ownership and Site RLS still apply.
+    const ownRoot = options.authorizationScope?.agentAccessViewer?.callerRootSessionId;
+    filters.push(
+      ownRoot
+        ? sql`(${schema.sessions.siteAccessRootId} is null OR ${schema.sessions.rootSessionId} = ${ownRoot}::uuid)`
+        : sql`${schema.sessions.siteAccessRootId} is null`,
     );
   }
   const archivedRoot = sql`exists (
@@ -33280,7 +33308,7 @@ async function readSessionListForSubject(
             throw new SessionListCursorError();
           }
           let nextOffset: number | null = null;
-          if (options.authorizationScope) {
+          {
             // A host may revoke rows between pages. Scan the immutable snapshot
             // in bounded database-filtered batches until this page is full plus
             // one authorized lookahead; never hydrate a stale broad slice and
@@ -33301,7 +33329,10 @@ async function readSessionListForSubject(
                   and(
                     eq(schema.sessions.workspaceId, workspaceId),
                     inArray(schema.sessions.id, candidates),
-                    sessionAuthorizationScopeFilter(options.authorizationScope),
+                    sql`${schema.sessions.siteAccessRootId} is null`,
+                    ...(options.authorizationScope
+                      ? [sessionAuthorizationScopeFilter(options.authorizationScope)]
+                      : []),
                   ),
                 );
               const allowed = new Set(allowedRows.map((row) => row.id));
@@ -33318,12 +33349,6 @@ async function readSessionListForSubject(
             if (visible.length > limit) {
               nextOffset = visible[limit - 1]!.offsetAfter;
             }
-          } else {
-            pageIds = snapshot.ordinarySessionIds.slice(cursor.offset, cursor.offset + limit);
-            const candidateOffset = cursor.offset + pageIds.length;
-            if (candidateOffset < snapshot.ordinarySessionIds.length) {
-              nextOffset = candidateOffset;
-            }
           }
           if (nextOffset !== null) {
             nextCursor = encodeSessionListCursor({
@@ -34755,7 +34780,15 @@ async function selectSessionDiscoveryPageRows(
   }
   if (options.filters.originSiteId) {
     authorizationFilters.push(
-      sql`${schema.sessions.metadata}->'_opengeniSiteOrigin'->>'siteId' = ${options.filters.originSiteId}`,
+      eq(schema.sessions.siteId, options.filters.originSiteId),
+      sql`${schema.sessions.siteAccessRootId} is not null`,
+    );
+  } else {
+    const ownRoot = options.authorizationScope?.agentAccessViewer?.callerRootSessionId;
+    authorizationFilters.push(
+      ownRoot
+        ? sql`(${schema.sessions.siteAccessRootId} is null OR ${schema.sessions.rootSessionId} = ${ownRoot}::uuid)`
+        : sql`${schema.sessions.siteAccessRootId} is null`,
     );
   }
   if (options.filters.activeOnly) {
@@ -36813,6 +36846,104 @@ export async function getSessionEvent(
   });
 }
 
+/**
+ * Trusted Site lifecycle only: cancel an exact published root using native
+ * controls. No request/agent endpoint exposes this adapter or its transaction.
+ * The host has authorized the Site mutation; its actor stays unchanged.
+ * Only the receipt and events written by this command leave the capability.
+ */
+export async function cancelSiteRuntimeConversation(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    siteId: string;
+    sessionId: string;
+    operationKey: string;
+    reason: string;
+  },
+) {
+  // Own the complete transaction, including activity finalization. A nested
+  // activity gate could otherwise outlive the exact-root visibility witness.
+  if (isTransactionHandle(db)) throw new Error("Site cancellation requires its own transaction");
+  return await runIdempotentPersistenceTransaction(
+    {
+      stage: "site_lifecycle.cancel",
+      eventTypes: ["session.control.paused", "turn.cancelled"],
+      maxAttempts: 3,
+    },
+    () =>
+      withRlsContext(db, input, async (scopedDb) => {
+        const [opened] = await rawRows<{ token: string | null }>(
+          scopedDb,
+          sql`
+        select opengeni_private.begin_site_session_cancellation(
+          ${input.accountId}::uuid,${input.workspaceId}::uuid,${input.siteId}::uuid,${input.sessionId}::uuid
+        ) as token`,
+        );
+        if (!opened?.token) return null;
+        const value = await withRestoredSessionActivityRlsContext(scopedDb, input, async (tx) => {
+          const [context] = await rawRows<{ actor: string | null }>(
+            tx,
+            sql`
+          select nullif(current_setting('opengeni.subject_id',true),'') as actor`,
+          );
+          // Serialize the active-state decision with native admission/control.
+          // Replays still enter the native receipt path after terminal settlement.
+          await lockWorkspaceInferenceControl(tx, input.workspaceId, "update");
+          const [candidate] = await rawRows<{ needed: boolean }>(
+            tx,
+            sql`
+          select exists(select 1 from sessions s
+            where s.workspace_id=${input.workspaceId} and s.site_access_root_id=${input.sessionId}::uuid
+              and s.status in ('queued','running','requires_action','recovering','waiting_capacity'))
+          or exists(select 1 from session_command_receipts r
+            where r.workspace_id=${input.workspaceId} and r.target_session_id=${input.sessionId}::uuid
+              and r.operation_key=${input.operationKey} and r.actor_type='service'
+              and r.actor_subject_id=${context?.actor ?? "site-lifecycle"}) as needed`,
+          );
+          if (!candidate?.needed) return null;
+          const result = await mutateSessionControlInTransaction(tx, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            sessionId: input.sessionId,
+            actor: { type: "service", subjectId: context?.actor ?? "site-lifecycle" },
+            operationKey: input.operationKey,
+            action: "cancel",
+            reason: input.reason,
+          });
+          const events: SessionEvent[] = [];
+          for (const affected of result.affectedSessionEvents) {
+            for (const eventId of affected.eventIds) {
+              const event = await getSessionEvent(tx, input.workspaceId, eventId);
+              if (!event || event.sessionId !== affected.sessionId)
+                throw new Error("Site cancellation lost its committed event");
+              events.push(event);
+            }
+          }
+          const workspaceEvent = result.workspaceControlEventId
+            ? await getWorkspaceControlEvent(tx, input.workspaceId, result.workspaceControlEventId)
+            : null;
+          return {
+            receiptId: result.receipt.id,
+            replay: result.replay,
+            cancelledSessionCount: result.cancelledSessionCount,
+            cancelledTurnCount: result.cancelledTurnCount,
+            wakeCount: result.wakeCount,
+            events,
+            workspaceEvent,
+          };
+        });
+        // Also covers activity-revision stamping. On error the outer transaction
+        // rolls the witness back, without masking the original SQL diagnostic.
+        await scopedDb.execute(
+          sql`select opengeni_private.end_site_session_cancellation(${opened.token}::uuid)`,
+        );
+        return value;
+      }),
+  );
+}
+
 /** Read one durable event under the exact human subject visibility projection. */
 export async function getSessionEventForSubject(
   db: Database,

package/src/insights-site-usage.ts

@@ -0,0 +1,37 @@
+import { sql } from "drizzle-orm";
+import {
+  InsightsSiteUsageResponse,
+  type InsightsSiteUsageQuery,
+} from "@opengeni/contracts/insights-usage";
+import { withRlsContext, type Database } from "./database";
+import { insightsUsageWindow } from "./insights-unified";
+
+/** Uses the native accounting ledger and frozen model-call price snapshots. */
+export async function readInsightsSiteUsage(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    query: InsightsSiteUsageQuery;
+    viewerSubjectId: string | null;
+    now: Date;
+  },
+): Promise<InsightsSiteUsageResponse> {
+  const window = insightsUsageWindow(input.query.range, input.now);
+  return withRlsContext(db, input, async (tx) => {
+    const result = await tx.execute(sql`select payload from opengeni_private.insights_site_usage(
+      ${input.accountId}::uuid, ${input.workspaceId}::uuid,
+      ${window.since.toISOString()}::timestamptz, ${window.until.toISOString()}::timestamptz,
+      ${input.viewerSubjectId}::text)`);
+    const rows = (Array.isArray(result) ? result : (result as { rows: unknown[] }).rows) as {
+      payload: unknown;
+    }[];
+    return InsightsSiteUsageResponse.parse({
+      workspaceId: input.workspaceId,
+      range: input.query.range,
+      windowStart: window.since.toISOString(),
+      windowEnd: window.until.toISOString(),
+      rows: rows.map((row) => row.payload),
+    });
+  });
+}

package/src/provision-roles.ts

@@ -2517,6 +2517,21 @@ BEGIN
       REVOKE ALL ON FUNCTION opengeni_private.insights_raw_amount_inputs(uuid,uuid,timestamptz,timestamptz) FROM PUBLIC;
       REVOKE ALL ON FUNCTION opengeni_private.insights_usage_payer(text,text), opengeni_private.insights_usage_filter(jsonb,jsonb) FROM PUBLIC;
     END IF;
+    IF to_regprocedure('opengeni_private.insights_site_usage(uuid,uuid,timestamptz,timestamptz,text)') IS NOT NULL THEN
+      REVOKE ALL ON FUNCTION opengeni_private.insights_site_usage(uuid,uuid,timestamptz,timestamptz,text) FROM PUBLIC;
+    END IF;
+    IF to_regclass('opengeni_private.site_session_cancellation_capabilities') IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.site_session_cancellation_capabilities FROM %I', ${literal(role)});
+      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.site_session_cancellation_capabilities FROM %I',
+        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute
+          WHERE attrelid='opengeni_private.site_session_cancellation_capabilities'::regclass AND attnum>0 AND NOT attisdropped), ${literal(role)});
+      REVOKE ALL ON TABLE opengeni_private.site_session_cancellation_capabilities FROM PUBLIC;
+      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.site_session_cancellation_capabilities FROM PUBLIC',
+        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute
+          WHERE attrelid='opengeni_private.site_session_cancellation_capabilities'::regclass AND attnum>0 AND NOT attisdropped));
+      REVOKE ALL ON FUNCTION opengeni_private.begin_site_session_cancellation(uuid,uuid,uuid,uuid),
+        opengeni_private.end_site_session_cancellation(uuid) FROM PUBLIC;
+    END IF;
     IF to_regclass('opengeni_private.usage_allowance_capabilities') IS NOT NULL THEN
       EXECUTE format('REVOKE ALL ON TABLE opengeni_private.usage_allowance_capabilities FROM %I', ${literal(role)});
       EXECUTE format('REVOKE ALL (backend_pid,transaction_id,data_schema,account_id,workspace_id) ON TABLE opengeni_private.usage_allowance_capabilities FROM %I', ${literal(role)});